The remote Windows host is missing security update 5005089 or cumulative update 5005088. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-34483, CVE-2021-34484,     CVE-2021-34537, CVE-2021-36927)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-34533, CVE-2021-34535, CVE-2021-36936,     CVE-2021-36937, CVE-2021-36947)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

The remote Windows host is missing security update 5005030.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-26432, CVE-2021-34530, CVE-2021-34533,     CVE-2021-34534, CVE-2021-34535, CVE-2021-36936,     CVE-2021-36937, CVE-2021-36947)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,     CVE-2021-34484, CVE-2021-34486, CVE-2021-34487,     CVE-2021-34536, CVE-2021-34537, CVE-2021-36948)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-26433, CVE-2021-36926,     CVE-2021-36932, CVE-2021-36933, CVE-2021-36938)

The remote Windows host is missing security update 5005043.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-26432, CVE-2021-34530, CVE-2021-34533,     CVE-2021-34534, CVE-2021-34535, CVE-2021-36936,     CVE-2021-36937, CVE-2021-36947)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,     CVE-2021-34484, CVE-2021-34487, CVE-2021-34536,     CVE-2021-34537)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-26433, CVE-2021-36926,     CVE-2021-36932, CVE-2021-36933, CVE-2021-36938)

The remote Windows host is missing security update 5005106 or cumulative update 5005076. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,     CVE-2021-34484, CVE-2021-34537, CVE-2021-36927)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-26432, CVE-2021-34533, CVE-2021-34535,     CVE-2021-36936, CVE-2021-36937, CVE-2021-36947)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-26433, CVE-2021-36926,     CVE-2021-36932, CVE-2021-36933)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

The remote Windows host is missing security update 5005095 or cumulative update 5005090. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-34533, CVE-2021-36936, CVE-2021-36937,     CVE-2021-36947)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-34483, CVE-2021-34484,     CVE-2021-36927)

The remote Windows host is missing security update 5005094 or cumulative update 5005099. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,     CVE-2021-34484, CVE-2021-36927)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-26432, CVE-2021-34533, CVE-2021-34535,     CVE-2021-36936, CVE-2021-36937, CVE-2021-36947)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-26433, CVE-2021-36926,     CVE-2021-36932, CVE-2021-36933)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

The remote host is affected by an NTLM reflection elevation of privilege vulnerability known as 'PetitPotam'. An unauthenticated, remote attacker can exploit this, by sending a specially-crafted EFSRPC request, to cause the affected host to connect to a malicious server. An attacker can then utilize an NTLM relay to impersonate the target host and authenticate against remote services.

One attack scenario, described within KB5005413, uses this exploit to initiate an NTLM session as a domain controller's machine account. This session is then relayed to an Active Directory Certificate Services (AD CS) host to obtain a certificate. This certificate could be then used to move laterally within the domain environment.

ID	Name	Product	Family	Severity
152436	KB5005089: Windows 7 and Windows Server 2008 R2 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152435	KB5005030: Windows 10 Version 1809 and Windows Server 2019 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152434	KB5005043: Windows 10 Version 1607 and Windows Server 2016 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152433	KB5005106: Windows 8.1 and Windows Server 2012 R2 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152425	KB5005095: Windows Server 2008 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152421	KB5005094: Windows Server 2012 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152102	Microsoft Windows EFSRPC NTLM Reflection Elevation of Privilege (PetitPotam) (Remote)	Nessus	Windows	high

Detections

Analytics

CVE-2021-36942

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high